System backups are typically made on a daily, weekly, monthly, and/or annual basis.  Backups usually include data or data extractions but may also include commercial or custom-designed software.

Core Policy and Procedures Manual (CPPM) chapter 12.3.2 prescribes that each ministry or agency has the authority, responsibility and accountability for establishing policy and standards regarding system backup and recovery procedures.   Backup procedures and their frequency differ from system to system.  Existing practice has been to re-use electronic backup media according to a re-use schedule established on a system-by-system basis.

To ensure that information stored on backup media is no longer accessible, one must:

• overwrite the previous information with non-meaningful data;
• physically destroy the backup media; or
• erase the backup media in such a way that previous information cannot be accessed through normal computer usage.

To ensure that information contained on backup media is secure and privacy and confidentiality concerns are safeguarded, do not leave these media in an unsecured area.

NOTE:  For transitory electronic data processing (EDP) records see special schedule 102902.

NOTE:  For electronic mail records see special schedule 102903.

SO = when backup records are no longer required for system recovery, the backup media must be re-used, destroyed or data previously recorded on the medium rendered inaccessible, in accordance with ministry or agency policy and procedures

nil = There is no semi-active retention period for computer system electronic backup records as the media is automatically slated for re-use and the information held on the media is only required until that system's backup cycle is completed.   System backups are typically made on a daily, weekly, monthly, and/or annual basis and the backup media re-used in accordance with the frequency plan established for a specific system.  In most cases, daily backups are kept onsite while weekly, monthly and annual backups are stored off-site as part of an agency's disaster recovery program.

DE = Ministry or agency policy and procedures regarding re-use of backup media MUST ensure that government information is destroyed the day following the end of the system-prescribed backup cycle whether the records are disposed of by the ministry, agency or their contracted agents.

FOI = Failure to ensure that information is rendered inaccessible creates a liability to government under the Freedom of Information and Protection of Privacy Act.